🚨 CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
🎖@cveNotify
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
🎖@cveNotify
🚨 CVE-2026-74800
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.
🎖@cveNotify
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.
🎖@cveNotify
GitHub
Stored XSS via arbitrary-file assets served same-origin without Content-Disposition or X-Content-Type-Options, escalating to full…
### Summary
SiYuan lets users attach/embed arbitrary files as "assets" (there is no
file-extension allowlist or denylist on upload). Assets are served back at
`GET /assets/*path`. For ...
SiYuan lets users attach/embed arbitrary files as "assets" (there is no
file-extension allowlist or denylist on upload). Assets are served back at
`GET /assets/*path`. For ...
🚨 CVE-2026-74801
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.
🎖@cveNotify
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.
🎖@cveNotify
GitHub
Unescaped workspace path concatenated into a UAC-elevated command line allows local privilege escalation via the bundled elevator.exe…
### Summary
On Windows, SiYuan can prompt to add a Windows Defender exclusion for the
install and workspace directories. To do this with the required
administrator rights, it launches a bundled ...
On Windows, SiYuan can prompt to add a Windows Defender exclusion for the
install and workspace directories. To do this with the required
administrator rights, it launches a bundled ...
🚨 CVE-2026-74869
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
🎖@cveNotify
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
🎖@cveNotify
GitHub
Missing authorization on Bonfire `Subscribe` — cross‑server member enumeration & profile/status surveillance (ban‑evasion)
### Summary
Bonfire decides what events to send a client purely from which pub/sub topic the socket is subscribed to — it never re-checks permissions on the event itself. The problem is the `Sub...
Bonfire decides what events to send a client purely from which pub/sub topic the socket is subscribed to — it never re-checks permissions on the event itself. The problem is the `Sub...
🚨 CVE-2026-74870
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.
🎖@cveNotify
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.
🎖@cveNotify
GitHub
hsm fido2-test/onlykey-test print the derived hardware pepper in cleartext
The 'openssl-encrypt hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to the terminal (openssl_encrypt/module...
🚨 CVE-2026-74875
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
🎖@cveNotify
GitHub
Schema validation silently skipped when jsonschema library is not installed
## Severity: HIGH
### Summary
In `openssl_encrypt/modules/json_validator.py` at **lines 234-238**, when the `jsonschema` library is not installed, all schema validation is silently skipped wi...
### Summary
In `openssl_encrypt/modules/json_validator.py` at **lines 234-238**, when the `jsonschema` library is not installed, all schema validation is silently skipped wi...
🚨 CVE-2026-74876
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.
🎖@cveNotify
GitHub
Unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys
## Severity: HIGH
### Summary
The `PublicKeyBundle.from_dict()` method in `openssl_encrypt/modules/key_bundle.py` at **lines 329-361** creates bundles from untrusted data without verifying th...
### Summary
The `PublicKeyBundle.from_dict()` method in `openssl_encrypt/modules/key_bundle.py` at **lines 329-361** creates bundles from untrusted data without verifying th...
🚨 CVE-2026-74879
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
🎖@cveNotify
GitHub
Readiness endpoint leaks database error details to unauthenticated callers
## Severity: HIGH
### Summary
The `/ready` endpoint in `openssl_encrypt_server/server.py` at **lines 159-175** catches database errors and returns the full exception string in the response.
...
### Summary
The `/ready` endpoint in `openssl_encrypt_server/server.py` at **lines 159-175** catches database errors and returns the full exception string in the response.
...
🚨 CVE-2026-74884
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
🎖@cveNotify
GitHub
Path traversal via unsanitized plugin_id in sandbox _is_safe_path
## Severity: HIGH
### Summary
The `_is_safe_path` method in `openssl_encrypt/modules/plugin_system/plugin_sandbox.py` at **lines 617-633** constructs a plugin config directory path using the unsa...
### Summary
The `_is_safe_path` method in `openssl_encrypt/modules/plugin_system/plugin_sandbox.py` at **lines 617-633** constructs a plugin config directory path using the unsa...
🚨 CVE-2026-74886
openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.
🎖@cveNotify
GitHub
Plugin import guard blocked modules not synchronized with AST analyzer
## Severity: HIGH
### Summary
The `PluginImportGuard` in `openssl_encrypt/modules/plugin_system/plugin_sandbox.py` at **lines 69-94** blocks a different set of modules than the AST analyzer's...
### Summary
The `PluginImportGuard` in `openssl_encrypt/modules/plugin_system/plugin_sandbox.py` at **lines 69-94** blocks a different set of modules than the AST analyzer's...
🚨 CVE-2026-74889
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
🎖@cveNotify
GitHub
HKDF key normalization uses no salt with static info parameter
## Severity: HIGH
### Summary
The `normalize_to_key_length_secure` function in `openssl_encrypt/modules/crypt_core.py` at **lines 2082-2088** and the parallel KDF equivalent `_normalize_bytes` in...
### Summary
The `normalize_to_key_length_secure` function in `openssl_encrypt/modules/crypt_core.py` at **lines 2082-2088** and the parallel KDF equivalent `_normalize_bytes` in...
🚨 CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.
🎖@cveNotify
GitHub
Hardcoded database credentials in standalone servers
## Severity: CRITICAL
### Summary
Both standalone servers ship with hardcoded database credentials as default connection strings.
### Affected Code
```python
# server/key-server/app/config.py:3...
### Summary
Both standalone servers ship with hardcoded database credentials as default connection strings.
### Affected Code
```python
# server/key-server/app/config.py:3...
🚨 CVE-2026-74894
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
🎖@cveNotify
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
🎖@cveNotify
GitHub
Standalone key server accepts ANY Bearer token as valid authentication
## Severity: CRITICAL
### Summary
The standalone key server's `verify_api_token()` function in `server/key-server/app/api/v1/keys.py` at **lines 48-87** only checks that a non-empty token str...
### Summary
The standalone key server's `verify_api_token()` function in `server/key-server/app/api/v1/keys.py` at **lines 48-87** only checks that a non-empty token str...
🚨 CVE-2026-74901
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.
🎖@cveNotify
GitHub
PQC fallback to unauthenticated AES-CTR when GCM fails
## Severity: CRITICAL
### Summary
In `openssl_encrypt/modules/pqc.py` at **lines 1400-1444**, when AES-GCM decryption fails (authentication error), the code falls back to **unauthenticated AES-CT...
### Summary
In `openssl_encrypt/modules/pqc.py` at **lines 1400-1444**, when AES-GCM decryption fails (authentication error), the code falls back to **unauthenticated AES-CT...
🚨 CVE-2026-74998
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
🎖@cveNotify
GitHub
Add basic validation for content proxied by the css proxy · roundcube/roundcubemail@62d33c8
The Roundcube Webmail suite. Contribute to roundcube/roundcubemail development by creating an account on GitHub.
🚨 CVE-2026-16137
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
🎖@cveNotify
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
🎖@cveNotify
Sharefile
ShareFile Storage Zones Controller (SZC) Service Disruption Guidance, Login Issues, and Access Information
This article addresses common questions related to the ShareFile Storage Zones Controller (SZC) service disruption notification, including whether the email communication is legitimate, why ShareFile access may be unavailable, login and authentication issues…
🚨 CVE-2026-16138
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
🎖@cveNotify
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
🎖@cveNotify
Sharefile
ShareFile Storage Zones Controller (SZC) Service Disruption Guidance, Login Issues, and Access Information
This article addresses common questions related to the ShareFile Storage Zones Controller (SZC) service disruption notification, including whether the email communication is legitimate, why ShareFile access may be unavailable, login and authentication issues…
🚨 CVE-2026-16139
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
🎖@cveNotify
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
🎖@cveNotify
Sharefile
ShareFile Storage Zones Controller (SZC) Service Disruption Guidance, Login Issues, and Access Information
This article addresses common questions related to the ShareFile Storage Zones Controller (SZC) service disruption notification, including whether the email communication is legitimate, why ShareFile access may be unavailable, login and authentication issues…
🚨 CVE-2026-19693
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
🎖@cveNotify
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
🎖@cveNotify
GitHub
GitHub - max-mapper/extract-zip: Zip extraction written in pure JavaScript. Extracts a zip into a directory.
Zip extraction written in pure JavaScript. Extracts a zip into a directory. - max-mapper/extract-zip
🚨 CVE-2026-10527
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691
🎖@cveNotify
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691
🎖@cveNotify
Mattermost.com
Security Updates
Find information about Mattermost security updates, sign up for our Security Bulletin, read our Responsible Disclosure Policy, and more.
🚨 CVE-2026-13202
A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation.
This issue affects Opentext Directory Services: through 22.2.
🎖@cveNotify
A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation.
This issue affects Opentext Directory Services: through 22.2.
🎖@cveNotify